Search form

Who's Afraid of Virginia's Voting Machines?

Who's Afraid of Virginia's Voting Machines?

Down over 7,000 votes to Democratic challenger Jim Webb, Virginia Senator George Allen today conceded. "It is with deep respect for the people of Virginia," Allen said, "that I do not wish to cause more rancor by protracted litigation which would in my judgment not alter the results."

With all due respect to Sen. Allen, how could he know for sure?

The long history of problems with electronic voting systems should have given him at least slight pause, especially in light of last week's documented incidents of Hart Intercivic voting machines apparently truncating the names of several candidates on the summary page, including the name of his opponent, now-Senator-elect Jim Webb. Or reports from election day that ES&S iVotronic machines in Sarasota, Florida, recorded 10,000 fewer votes for a Congressional race than for other high-profile races.

The majority of Virginia counties use touchscreen direct recording electronic (DRE) voting machines, and most of those counties use DREs that do not generate voter-verified paper ballots. Instead of creating anything truly useful for officials to recount, the machines simply reproduce data that is already in memory, in effect reprinting the results rather than recounting ballots in any meaningful sense. Mechanical problems or manipulation affecting the initial vote totals would most likely not be spotted by simply reprinting the same results.

More troubling, Virginia's recount statute nowhere explicitly gives candidates access to the only materials generated by DREs that could be relevant to determining whether votes were miscounted or manipulated: backup memories and audit logs. According to Virginia law, in order to "redetermine" DRE totals as part of a recount, "[R]ecount officials shall open the envelopes with the [end of the day vote summary] printouts and read the results from the printouts. If the printout is not clear, or on the request of the court, the recount officials shall rerun the printout from the machine..." In other words, a recount of Virginia DRE vote totals would by default consist of recount officials looking at the same summary totals that were printed out earlier in the process or, if the printout was unclear or (at the discretion of the court), generating an identical summary printout.

While optical scan ballots are capable of hand-counting if need be (and legal provisions are in place in Virginia to perform such a hand-count), paperless DREs have effectively eliminated that capability. At the same time, Virginia law appears to excuse the DREs' shortcomings and effectively removes ballots cast on such machines from recount scrutiny, replacing a process designed to verify results with an antithetical "trust the technology" farce.

Virginia election law, like state law around the country, remains woefully behind the times when it comes to adequately considering new voting technology and the vulnerabilities that come with it. In Virginia, outgoing Senator Allen's concession eliminated the need for the spectacle of county election officials proudly declaring that they could once again read pieces of paper that announced vote totals that they could not independently verify. It has not eliminated, and should not eliminate, the drive to both improve the technology and to correct Virginia's law. Without state or national legislation that sets tougher standards, the procedural mess avoided today will eventually arrive.

Related Updates

Javier Smaldone is a well-known figure in the Argentinian infosec community. As a security researcher, he’s worked to highlight the flaws in electronic voting in Argentina, despite the country’s local and federal attempts to move ahead with insecure software and electoral procedures. The Argentinian authorities have a reputation...

Sen. Ron Wyden’s new proposal to protect the integrity of U.S. elections, the Protecting American Votes and Elections (PAVE) Act of 2019, takes a much needed step forward by requiring a return to paper ballots. The bill forcefully addresses a grave threat to American democracy—outdated election technologies used...

UPDATE February 9 2019: Victory! These bills did not make it out of committee. Experts agree: Internet voting would be an information security disaster. Unfortunately, the Commonwealth of Virginia is considering a pair of bills to experiment with online voting. Pilot programs will do nothing to contradict the...

The ability to vote for local, state, and federal representatives is the cornerstone of democracy in America. With mid-term congressional elections looming in early November, many voices have raised concerns that the voting infrastructure used by states across the Union might be suspect, unreliable, or potentially vulnerable to attacks. As...

Right now, the U.S. Senate is debating an issue that’s critical to our democratic future: secure elections. Hacking attacks were used to try to undermine the 2016 U.S. election, and in recent years, elections in Latin America and Ukraine were also subject to cyber attacks. It only makes sense to...

The Senate is working on a bill to secure election infrastructure against cybersecurity threats, but, unless amended, it will widely miss the mark. The current text of the Secure Elections Act1 omits the two most effective measures that could secure...

Election security experts concerned about voting machines are calling for an audit of ballots in the three states where the presidential election was very close: Michigan, Wisconsin and Pennsylvania. We agree. This is an important election safety measure and should happen in all elections, not just those that have...

Most of the internet’s most popular voter registration sites make no promise to not turn and sell your information to advertisers, a Vocativ analysis has found. Of the nine major voter registration sites surveyed, only vote.gov, maintained by the U.S. General Services Administration, explicitly promises to neither share...